# Wso2 Open Banking AM vulnerabilities Source: https://junglewise.ai/threats/technologies/open-banking-am Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/open-banking-am.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 11 vulnerabilities in Wso2 Open Banking AM: 0 in the last 7 days and 5 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-18800, was published on 2 November 2026. 3 vulnerabilities in the last four weeks, up 200% on the four before (1). 1 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 5 - All time: 11 (1 critical, 0 exploited in the wild) ## About Wso2 Open Banking AM An identity and access management solution designed for compliance with open banking standards. ## Latest Wso2 Open Banking AM vulnerabilities - [CVE-2026-18800: WSO2 products sensitive information disclosure in Event Publisher logs](https://junglewise.ai/threats/cve-2026-18800-when-an-event-publisher-output-adapter-is-configured-with) (medium, CVSS 4.4, published 2 Nov 2026) - [CVE-2025-11969: WSO2 System REST APIs access control bypass](https://junglewise.ai/threats/cve-2025-11969-the-system-rest-apis-do-not-correctly-enforce-access-control) (critical, CVSS 9.4, published 2 Nov 2026) - [CVE-2025-13173: WSO2 products session-bound token improper revocation](https://junglewise.ai/threats/cve-2025-13173-tokens-associated-with-user-sessions-are-not-revoked-when-the) (medium, CVSS 6.5, published 19 Oct 2026) - [CVE-2025-5802: WSO2 Identity Server username enumeration in self-registration](https://junglewise.ai/threats/cve-2025-5802-wso2-identity-server-username-enumeration-in-self-registration) (medium, CVSS 5.3, published 15 Sep 2026) - [CVE-2025-12737: WSO2 Carbon Console remote code execution in administrative operations](https://junglewise.ai/threats/cve-2025-12737-wso2-carbon-console-remote-code-execution-in-administrative) (high, CVSS 8.4, published 3 Sep 2026) - [CVE-2026-0637: When a proxy server is configured with `customUrl.enabled`, the component accepts user-supplied input within forwarded…](https://junglewise.ai/threats/cve-2026-0637-when-a-proxy-server-is-configured-with-customurl-enabled-the) (medium, CVSS 5.4, published 6 Aug 2026) - [CVE-2024-8995: Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This…](https://junglewise.ai/threats/cve-2024-8995-unused-authorization-codes-issued-to-deleted-users-are-not-being) (medium, CVSS 4.9, published 6 Aug 2026) - [CVE-2024-6832: The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not…](https://junglewise.ai/threats/cve-2024-6832-the-account-locking-mechanism-fails-to-trigger-when-secondary-user) (medium, CVSS 5.9, published 6 Aug 2026) - [CVE-2025-8591: WSO2 multiple products reflected XSS via URL parameter](https://junglewise.ai/threats/cve-2025-8591-wso2-multiple-products-reflected-xss-via-url-parameter) (medium, CVSS 6.1, published 6 Jul 2026) - [CVE-2024-1248: WSO2 multiple products role overwrite in Silent JIT Provisioning](https://junglewise.ai/threats/cve-2024-1248-wso2-multiple-products-role-overwrite-in-silent-jit-provisioning) (medium, CVSS 4.8, published 4 Jul 2026) - [CVE-2024-2374: The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent…](https://junglewise.ai/threats/cve-2024-2374-the-xml-parsers-within-multiple-wso2-products-accept-user-supplied) (high, CVSS 7.5, published 16 Apr 2026) ## Most severe Wso2 Open Banking AM vulnerabilities - [CVE-2025-11969: WSO2 System REST APIs access control bypass](https://junglewise.ai/threats/cve-2025-11969-the-system-rest-apis-do-not-correctly-enforce-access-control) (critical, CVSS 9.4, published 2 Nov 2026) - [CVE-2025-12737: WSO2 Carbon Console remote code execution in administrative operations](https://junglewise.ai/threats/cve-2025-12737-wso2-carbon-console-remote-code-execution-in-administrative) (high, CVSS 8.4, published 3 Sep 2026) - [CVE-2024-2374: The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent…](https://junglewise.ai/threats/cve-2024-2374-the-xml-parsers-within-multiple-wso2-products-accept-user-supplied) (high, CVSS 7.5, published 16 Apr 2026) - [CVE-2025-13173: WSO2 products session-bound token improper revocation](https://junglewise.ai/threats/cve-2025-13173-tokens-associated-with-user-sessions-are-not-revoked-when-the) (medium, CVSS 6.5, published 19 Oct 2026) - [CVE-2025-8591: WSO2 multiple products reflected XSS via URL parameter](https://junglewise.ai/threats/cve-2025-8591-wso2-multiple-products-reflected-xss-via-url-parameter) (medium, CVSS 6.1, published 6 Jul 2026) - [CVE-2024-6832: The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not…](https://junglewise.ai/threats/cve-2024-6832-the-account-locking-mechanism-fails-to-trigger-when-secondary-user) (medium, CVSS 5.9, published 6 Aug 2026) - [CVE-2026-0637: When a proxy server is configured with `customUrl.enabled`, the component accepts user-supplied input within forwarded…](https://junglewise.ai/threats/cve-2026-0637-when-a-proxy-server-is-configured-with-customurl-enabled-the) (medium, CVSS 5.4, published 6 Aug 2026) - [CVE-2025-5802: WSO2 Identity Server username enumeration in self-registration](https://junglewise.ai/threats/cve-2025-5802-wso2-identity-server-username-enumeration-in-self-registration) (medium, CVSS 5.3, published 15 Sep 2026) - [CVE-2024-8995: Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This…](https://junglewise.ai/threats/cve-2024-8995-unused-authorization-codes-issued-to-deleted-users-are-not-being) (medium, CVSS 4.9, published 6 Aug 2026) - [CVE-2024-1248: WSO2 multiple products role overwrite in Silent JIT Provisioning](https://junglewise.ai/threats/cve-2024-1248-wso2-multiple-products-role-overwrite-in-silent-jit-provisioning) (medium, CVSS 4.8, published 4 Jul 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, up 200% on the four before (1). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 2 | 1 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Wso2 technologies - [Wso2 API Manager](https://junglewise.ai/threats/technologies/api-manager): 38 vulnerabilities - [Wso2 Identity Server](https://junglewise.ai/threats/technologies/identity-server): 38 vulnerabilities - [Wso2 API Control Plane](https://junglewise.ai/threats/technologies/api-control-plane): 26 vulnerabilities - [Wso2 Traffic Manager](https://junglewise.ai/threats/technologies/traffic-manager): 19 vulnerabilities - [Wso2 Universal Gateway](https://junglewise.ai/threats/technologies/universal-gateway): 19 vulnerabilities - [Wso2 Identity Server as Key Manager](https://junglewise.ai/threats/technologies/identity-server-as-key-manager): 15 vulnerabilities - [Wso2 Open Banking IAM](https://junglewise.ai/threats/technologies/open-banking-iam): 15 vulnerabilities - [Wso2 Enterprise Integrator](https://junglewise.ai/threats/technologies/enterprise-integrator): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Wso2 Open Banking AM vulnerabilities", https://junglewise.ai/threats/technologies/open-banking-am, 10 November 2026.